@synopackageland/cli 0.7.3 → 0.9.0

package/templates/native-go/backend/internal/dsm/auth_test.go

@@ -1,159 +0,0 @@
-package dsm
-
-import (
-	"context"
-	"errors"
-	"net/http"
-	"net/http/httptest"
-	"slices"
-	"strings"
-	"testing"
-
-	"dsmapp/internal/api"
-)
-
-type fakeRunner struct {
-	out  string
-	err  error
-	env  []string
-	path string
-}
-
-func (f *fakeRunner) run(_ context.Context, path string, env []string) ([]byte, error) {
-	f.path, f.env = path, env
-	return []byte(f.out), f.err
-}
-
-func newTestAuth(t *testing.T, runner *fakeRunner) *Authenticator {
-	t.Helper()
-	a := NewAuthenticator()
-	a.isAdministrator = func(_ context.Context, name string) (bool, error) {
-		return name == "alice" || name == `CORP\alice` || name == "alice@example.com", nil
-	}
-	a.run = runner.run
-	return a
-}
-
-func sessionRequest() *http.Request {
-	r := httptest.NewRequest(http.MethodPost, "/webman/3rdparty/App/cgi/api.cgi", nil)
-	r.RemoteAddr = "192.0.2.7:51234"
-	r.Header.Set("Cookie", "id=abc; did=xyz")
-	r.Header.Set("X-SYNO-TOKEN", "tok+en/=")
-	r.Header.Set("User-Agent", "should-not-pass")
-	return r
-}
-
-func TestAdminUserIsResolvedFromAuthenticateCGIAndNativeProvider(t *testing.T) {
-	runner := &fakeRunner{out: "alice\n"}
-	id, err := newTestAuth(t, runner).Authenticate(sessionRequest())
-	if err != nil || id.User != "alice" || !id.Admin {
-		t.Fatalf("got %+v, %v", id, err)
-	}
-	if runner.path != AuthenticateCGI {
-		t.Errorf("ran %q", runner.path)
-	}
-}
-
-func TestOrdinaryUserIsNotAdmin(t *testing.T) {
-	id, err := newTestAuth(t, &fakeRunner{out: "bob\n"}).Authenticate(sessionRequest())
-	if err != nil || id.User != "bob" || id.Admin {
-		t.Fatalf("got %+v, %v", id, err)
-	}
-}
-
-func TestOnlySessionCarriersReachAuthenticateCGI(t *testing.T) {
-	runner := &fakeRunner{out: "alice"}
-	if _, err := newTestAuth(t, runner).Authenticate(sessionRequest()); err != nil {
-		t.Fatal(err)
-	}
-	want := []string{
-		"HTTP_COOKIE=id=abc; did=xyz",
-		"HTTP_X_SYNO_TOKEN=tok+en/=",
-		"QUERY_STRING=SynoToken=tok%2Ben%2F%3D",
-		"REMOTE_ADDR=192.0.2.7",
-		"REQUEST_METHOD=GET",
-	}
-	got := slices.Clone(runner.env)
-	slices.Sort(got)
-	if !slices.Equal(got, want) {
-		t.Fatalf("env = %q\nwant  %q", got, want)
-	}
-}
-
-func TestMissingCookieNeverRunsAuthenticateCGI(t *testing.T) {
-	runner := &fakeRunner{out: "alice"}
-	r := sessionRequest()
-	r.Header.Del("Cookie")
-	_, err := newTestAuth(t, runner).Authenticate(r)
-	if !errors.Is(err, api.ErrNoSession) || runner.path != "" {
-		t.Fatalf("err=%v ran=%q", err, runner.path)
-	}
-}
-
-func TestRejectedOrMalformedSessionsAreNoSession(t *testing.T) {
-	for name, runner := range map[string]*fakeRunner{
-		"exit status":     {err: &exitError{}},
-		"empty output":    {out: "\n"},
-		"two lines":       {out: "alice\nadmin\n"},
-		"html output":     {out: "<html>login</html>"},
-		"overlong name":   {out: strings.Repeat("a", 1025)},
-		"control in name": {out: "alice\x00admin"},
-	} {
-		t.Run(name, func(t *testing.T) {
-			_, err := newTestAuth(t, runner).Authenticate(sessionRequest())
-			if !errors.Is(err, api.ErrNoSession) {
-				t.Fatalf("err = %v", err)
-			}
-		})
-	}
-}
-
-func TestBrokenAuthenticatorIsUnavailableNotNoSession(t *testing.T) {
-	_, err := newTestAuth(t, &fakeRunner{err: errors.New("exec: not found")}).Authenticate(sessionRequest())
-	if err == nil || errors.Is(err, api.ErrNoSession) {
-		t.Fatalf("err = %v", err)
-	}
-}
-
-func TestUnavailableNativeRoleFailsClosed(t *testing.T) {
-	a := newTestAuth(t, &fakeRunner{out: "alice"})
-	a.isAdministrator = func(context.Context, string) (bool, error) { return false, errors.New("native unavailable") }
-	if _, err := a.Authenticate(sessionRequest()); err == nil || errors.Is(err, api.ErrNoSession) {
-		t.Fatalf("err=%v, want unavailable", err)
-	}
-}
-
-type exitError struct{}
-
-func (*exitError) Error() string { return "exit status 1" }
-func (*exitError) ExitCode() int { return 1 }
-
-func TestAdministratorMembershipIsQueriedEachRequestAndNotAnAccountName(t *testing.T) {
-	runner := &fakeRunner{out: "admin"}
-	a := newTestAuth(t, runner)
-	currentAdmin := false
-	calls := 0
-	a.isAdministrator = func(context.Context, string) (bool, error) { calls++; return currentAdmin, nil }
-	id, err := a.Authenticate(sessionRequest())
-	if err != nil || id.Admin {
-		t.Fatalf("account name granted privileges: %+v %v", id, err)
-	}
-	runner.out, currentAdmin = "alice", true
-	id, err = a.Authenticate(sessionRequest())
-	if err != nil || !id.Admin {
-		t.Fatalf("native administrator refused: %+v %v", id, err)
-	}
-	currentAdmin = false
-	id, err = a.Authenticate(sessionRequest())
-	if err != nil || id.Admin || calls != 3 {
-		t.Fatalf("stale role retained: %+v %v calls=%d", id, err, calls)
-	}
-}
-
-func TestDirectoryAdministratorMustUseDSMRoleProvider(t *testing.T) {
-	a := newTestAuth(t, &fakeRunner{out: `CORP\alice`})
-	id, err := a.Authenticate(sessionRequest())
-	if err != nil || !id.Admin {
-		t.Fatalf("DSM directory administrator refused: %+v %v", id, err)
-	}
-}

package/templates/native-go/backend/internal/dsm/bridge_file.go

@@ -1,75 +0,0 @@
-package dsm
-
-import (
-	"errors"
-	"os"
-	"path/filepath"
-	"syscall"
-)
-
-// bridgeFallbackDir is where a kernel without memfd_create (DSM 7 platforms on
-// Linux 3.10) stages the bridge. Empty refuses, as before the fallback existed.
-var bridgeFallbackDir string
-
-// SetBridgeFallbackDir names the package's own temp directory,
-// /var/packages/<package>/tmp. main calls it once, before serving.
-func SetBridgeFallbackDir(dir string) { bridgeFallbackDir = dir }
-
-var errBridgeDir = errors.New("bridge fallback directory must be a private absolute directory")
-
-// unlinkedBridge stages payload in a fresh 0700 directory under dir and returns
-// a read-only descriptor whose name is already gone. /tmp is noexec on DSM, so
-// dir is the package's own exec-capable temp. Unlike a sealed memfd, a process
-// running as the same package account could rewrite the file before it is
-// unlinked; that account already controls the CGI, so the trust is unchanged.
-func unlinkedBridge(dir string, payload []byte) (*os.File, error) {
-	if err := privateDir(dir); err != nil {
-		return nil, err
-	}
-	stage, err := os.MkdirTemp(dir, "bridge-")
-	if err != nil {
-		return nil, err
-	}
-	defer os.RemoveAll(stage)
-	path := filepath.Join(stage, "bridge")
-	writer, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)
-	if err != nil {
-		return nil, err
-	}
-	_, err = writer.Write(payload)
-	if closeErr := writer.Close(); err == nil {
-		err = closeErr
-	}
-	if err == nil {
-		err = os.Chmod(path, 0o500)
-	}
-	if err != nil {
-		return nil, err
-	}
-	file, err := os.Open(path)
-	if err != nil {
-		return nil, err
-	}
-	if err = os.Remove(path); err != nil {
-		file.Close()
-		return nil, err
-	}
-	return file, nil
-}
-
-// privateDir accepts an absolute directory owned by this account and writable
-// by no one else. It follows links: DSM's /var/packages/<pkg>/tmp is one.
-func privateDir(dir string) error {
-	if !filepath.IsAbs(dir) {
-		return errBridgeDir
-	}
-	info, err := os.Stat(dir)
-	if err != nil {
-		return err
-	}
-	st, ok := info.Sys().(*syscall.Stat_t)
-	if !info.IsDir() || info.Mode().Perm()&0o022 != 0 || !ok || int(st.Uid) != os.Geteuid() {
-		return errBridgeDir
-	}
-	return nil
-}

package/templates/native-go/backend/internal/dsm/bridge_file_test.go

@@ -1,57 +0,0 @@
-package dsm
-
-import (
-	"io"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestUnlinkedBridgeLeavesOnlyAReadOnlyDescriptor(t *testing.T) {
-	dir := t.TempDir()
-	file, err := unlinkedBridge(dir, []byte("bridge"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer file.Close()
-	got, err := io.ReadAll(file)
-	if err != nil || string(got) != "bridge" {
-		t.Fatalf("payload %q %v", got, err)
-	}
-	if _, err = file.Seek(0, io.SeekStart); err != nil {
-		t.Fatal(err)
-	}
-	if _, err = file.Write([]byte("attack")); err == nil {
-		t.Fatal("bridge descriptor is writable")
-	}
-	info, err := file.Stat()
-	if err != nil || info.Mode().Perm() != 0o500 {
-		t.Fatalf("mode %v %v", info.Mode(), err)
-	}
-	if entries, err := os.ReadDir(dir); err != nil || len(entries) != 0 {
-		t.Fatalf("bridge left a name behind: %v %v", entries, err)
-	}
-}
-
-func TestUnlinkedBridgeRefusesWithoutAPrivateDirectory(t *testing.T) {
-	shared := t.TempDir()
-	if err := os.Chmod(shared, 0o777); err != nil {
-		t.Fatal(err)
-	}
-	link := filepath.Join(t.TempDir(), "link")
-	if err := os.Symlink(t.TempDir(), link); err != nil {
-		t.Fatal(err)
-	}
-	for name, dir := range map[string]string{"unset": "", "relative": "tmp", "missing": filepath.Join(shared, "none"), "shared": shared} {
-		if file, err := unlinkedBridge(dir, []byte("bridge")); err == nil {
-			file.Close()
-			t.Fatalf("%s directory accepted", name)
-		}
-	}
-	// DSM's /var/packages/<pkg>/tmp is a root-owned link to @apptemp/<pkg>.
-	file, err := unlinkedBridge(link, []byte("bridge"))
-	if err != nil {
-		t.Fatalf("linked private directory refused: %v", err)
-	}
-	file.Close()
-}

package/templates/native-go/backend/internal/dsm/entry.go

@@ -1,177 +0,0 @@
-package dsm
-
-// The entry gate decides who may use the app at all, before any route policy.
-// It wraps the session authenticator, so every API method, transfer and the
-// window's own calls share one decision; apps never implement it themselves.
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net"
-	"net/http"
-	"os"
-	"path/filepath"
-	"regexp"
-	"sort"
-	"time"
-
-	"dsmapp/internal/api"
-)
-
-const (
-	// EntryAdminOnly admits only DSM administrators.
-	EntryAdminOnly = "admin-only"
-	// EntryAppPrivilege admits administrators and any account that DSM's
-	// Control Panel > Application Privileges allows for this app.
-	EntryAppPrivilege = "app-privilege"
-
-	// EntryCacheTTL bounds how long a privilege change can take to apply.
-	EntryCacheTTL = 30 * time.Second
-	// EntryCacheMaxEntries bounds the cache file whatever the traffic.
-	EntryCacheMaxEntries = 256
-
-	entryCacheFile = "entry-cache.json"
-)
-
-var packageName = regexp.MustCompile(`^[A-Za-z][A-Za-z0-9]{1,63}$`)
-
-// EntryGate is an api.Authenticator that admits a verified caller only when
-// the app's entry mode allows it.
-type EntryGate struct {
-	next    api.Authenticator
-	mode    string
-	app     string
-	dir     string
-	now     func() time.Time
-	allowed func(ctx context.Context, principal, app, addr string) (bool, error)
-}
-
-// NewEntryGate wraps next for the build-time entry mode. An empty mode keeps
-// next unchanged: the route policy alone decides, as before entry modes.
-// dataDir holds the short-lived decision cache shared by CGI processes.
-func NewEntryGate(next api.Authenticator, mode, packageID, dataDir string) (api.Authenticator, error) {
-	if next == nil {
-		return nil, errors.New("entry gate needs an authenticator")
-	}
-	switch mode {
-	case "":
-		return next, nil
-	case EntryAdminOnly, EntryAppPrivilege:
-	default:
-		return nil, fmt.Errorf("unknown entry mode %q", mode)
-	}
-	if !packageName.MatchString(packageID) {
-		return nil, fmt.Errorf("invalid package ID %q", packageID)
-	}
-	return &EntryGate{next: next, mode: mode, app: "SYNO.SDS." + packageID + ".Instance", dir: filepath.Join(dataDir, "entry"), now: time.Now, allowed: AppPrivilege}, nil
-}
-
-func (g *EntryGate) Authenticate(r *http.Request) (api.Identity, error) {
-	id, err := g.next.Authenticate(r)
-	if err != nil || id.Admin {
-		return id, err
-	}
-	if g.mode == EntryAdminOnly {
-		return api.Identity{}, api.ErrAdminRequired
-	}
-	addr, err := clientAddress(r)
-	if err != nil {
-		return api.Identity{}, err
-	}
-	allowed, err := g.decide(r.Context(), id.User, addr)
-	if err != nil {
-		return api.Identity{}, err
-	}
-	if !allowed {
-		return api.Identity{}, api.ErrAppPrivilegeDenied
-	}
-	return id, nil
-}
-
-// clientAddress is the browser's address as DSM's web server reported it
-// (REMOTE_ADDR); DSM's IP rules are evaluated against it.
-func clientAddress(r *http.Request) (string, error) {
-	host, _, err := net.SplitHostPort(r.RemoteAddr)
-	if err != nil {
-		host = r.RemoteAddr
-	}
-	ip := net.ParseIP(host)
-	if ip == nil {
-		return "", errors.New("client address unavailable")
-	}
-	return ip.String(), nil
-}
-
-type cachedDecision struct {
-	Allowed bool  `json:"allowed"`
-	At      int64 `json:"at"`
-}
-
-func (g *EntryGate) decide(ctx context.Context, principal, addr string) (bool, error) {
-	sum := sha256.Sum256([]byte(principal + "\x00" + g.app + "\x00" + addr))
-	key := hex.EncodeToString(sum[:])
-	now := g.now().Unix()
-	entries, _ := g.readCache()
-	if d, ok := entries[key]; ok && d.At <= now && now-d.At < int64(EntryCacheTTL/time.Second) {
-		return d.Allowed, nil
-	}
-	allowed, err := g.allowed(ctx, principal, g.app, addr)
-	if err != nil {
-		return false, err
-	}
-	if entries == nil {
-		entries = map[string]cachedDecision{}
-	}
-	entries[key] = cachedDecision{Allowed: allowed, At: now}
-	g.writeCache(entries, now)
-	return allowed, nil
-}
-
-func (g *EntryGate) readCache() (map[string]cachedDecision, error) {
-	data, err := os.ReadFile(filepath.Join(g.dir, entryCacheFile))
-	if err != nil {
-		return nil, err
-	}
-	var entries map[string]cachedDecision
-	if err := json.Unmarshal(data, &entries); err != nil {
-		return nil, err
-	}
-	return entries, nil
-}
-
-// writeCache keeps only fresh entries, newest first, up to the bound. A failed
-// write only costs the next request a fresh lookup.
-func (g *EntryGate) writeCache(entries map[string]cachedDecision, now int64) {
-	keys := make([]string, 0, len(entries))
-	for k, d := range entries {
-		if d.At <= now && now-d.At < int64(EntryCacheTTL/time.Second) {
-			keys = append(keys, k)
-		}
-	}
-	sort.Slice(keys, func(i, j int) bool { return entries[keys[i]].At > entries[keys[j]].At })
-	if len(keys) > EntryCacheMaxEntries {
-		keys = keys[:EntryCacheMaxEntries]
-	}
-	kept := make(map[string]cachedDecision, len(keys))
-	for _, k := range keys {
-		kept[k] = entries[k]
-	}
-	data, err := json.Marshal(kept)
-	if err != nil || os.MkdirAll(g.dir, 0o700) != nil {
-		return
-	}
-	tmp, err := os.CreateTemp(g.dir, entryCacheFile+".*")
-	if err != nil {
-		return
-	}
-	defer os.Remove(tmp.Name())
-	if _, err := tmp.Write(data); err != nil || tmp.Close() != nil {
-		tmp.Close()
-		return
-	}
-	os.Rename(tmp.Name(), filepath.Join(g.dir, entryCacheFile))
-}